Adaptive monitoring for cellular networks

ABSTRACT

Various embodiments provide adaptive monitoring of a wireless communication network. In one embodiment, a first set of network data generated for a wireless communication network is analyzed. The first set of network data is a set of historical network data for the wireless communication network. A baseline for at least one operating characteristic associated with the wireless communication network is determined based on the analyzing. A second set of network data generated for the wireless communication network is received. The second set of call detail records that has been received is utilized to determine if the at least one operating characteristic corresponds to the baseline. A set of monitoring operations performed by a network management system with respect to the wireless communication network is dynamically adjusted based on the at least one operating characteristic failing to correspond to the baseline.

BACKGROUND

The present invention generally relates to wireless communicationnetworks, and more particularly relates to controlling the monitoringoperation of a wireless communication network.

Telecom networks generally comprise a large number of elements andprovide a diverse set of services to their customers. These networksrequire a very high degree of reliability and availability to provide asatisfactory user experience. However, the size and complexity of thesenetworks makes it difficult to monitor them efficiently.

BRIEF SUMMARY

In one embodiment, a method for adaptive monitoring of a wirelesscommunication network is disclosed. The method comprises analyzing afirst set of network data generated for a wireless communicationnetwork. The first set of network data is a set of historical networkdata for the wireless communication network. A baseline for at least oneoperating characteristic associated with the wireless communicationnetwork is determined based on the analyzing. A second set of networkdata generated for the wireless communication network is received. Theset of call detail records that has been received is utilized todetermine if the at least one operating characteristic corresponds tothe baseline. A set of monitoring operations performed by a networkmanagement system with respect to the wireless communication network isdynamically adjusted based on the at least one operating characteristicfailing to correspond to the baseline.

In another embodiment, a computer program storage product for adaptivemonitoring of a wireless communication network is disclosed. Thecomputer program storage product comprising instructions configured toperform a method. The method comprises analyzing a first set of networkdata generated for a wireless communication network. The first set ofnetwork data is a set of historical network data for the wirelesscommunication network. A baseline for at least one operatingcharacteristic associated with the wireless communication network isdetermined based on the analyzing. A second set of network datagenerated for the wireless communication network is received. The set ofcall detail records that has been received is utilized to determine ifthe at least one operating characteristic corresponds to the baseline. Aset of monitoring operations performed by a network management systemwith respect to the wireless communication network is dynamicallyadjusted based on the at least one operating characteristic failing tocorrespond to the baseline.

In another embodiment, an information processing system for adaptivemonitoring of a wireless communication network is disclosed. Theinformation processing system comprises a memory and a processor that iscommunicatively coupled to the memory. An adaptive monitor iscommunicatively coupled to the memory and the processor. The adaptivemonitor is configured to perform a method. The method comprisesanalyzing a first set of network data generated for a wirelesscommunication network. The first set of network data is a set ofhistorical network data for the wireless communication network. Abaseline for at least one operating characteristic associated with thewireless communication network is determined based on the analyzing. Asecond set of network data generated for the wireless communicationnetwork is received. The set of call detail records that has beenreceived is utilized to determine if the at least one operatingcharacteristic corresponds to the baseline. A set of monitoringoperations performed by a network management system with respect to thewireless communication network is dynamically adjusted based on the atleast one operating characteristic failing to correspond to thebaseline.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The accompanying figures where like reference numerals refer toidentical or functionally similar elements throughout the separateviews, and which together with the detailed description below areincorporated in and form part of the specification, serve to furtherillustrate various embodiments and to explain various principles andadvantages all in accordance with the present invention, in which:

FIG. 1 is a block diagram illustrating one example of an operatingenvironment according to one embodiment of the present invention;

FIG. 2 is a block diagram illustrating a detailed view of an adaptivemonitoring manager according to one embodiment of the present invention;

FIG. 3 is an operational flow diagram illustrating one example ofadaptive monitoring in a wireless communication network according to oneembodiment of the present invention;

FIG. 4 is an operational flow diagram illustrating another example ofadaptive monitoring in a wireless communication network according to oneembodiment of the present invention and

FIG. 5 is a block diagram illustrating one example of an informationprocessing system according to one embodiment of the present invention.

DETAILED DESCRIPTION

Operating Environment

FIG. 1 shows an operating environment 100 according to one embodiment ofthe present invention. The operating environment 100 comprises one ormore wireless communication networks 102 that are communicativelycoupled to one or more wire line networks 104. For purposes ofsimplicity, only the portions of these networks that are relevant toembodiments of the present invention are described. The wire linenetwork 104 acts as a back-end for the wireless communication network102. In this embodiment, the wire line network 104 comprises one or moreaccess/core networks of the wireless communication network 102 and oneor more Internet Protocol (IP) networks such as the Internet. The wireline network 104 communicatively couples one or more servers 106 such as(but not limited to) content sources/providers to the wirelesscommunication network 102. In further embodiments, the back-end is not awire line network. For example, the back-end takes the form of a networkof peers in which a mobile base station (e.g., eNode B in the case ofGSM and its descendants) is itself used as a back-end network for otherbase stations.

The wireless communication network 102 supports any wirelesscommunication standard such as, but not limited to, Global System forMobile Communications (GSM), Code Division Multiple Access (CDMA), TimeDivision Multiple Access (TDMA), General Packet Radio Service (GPRS),Frequency Division Multiple Access (FDMA), Orthogonal Frequency DivisionMultiplexing (OFDM), or the like. The wireless communication network 102includes one or more networks based on such standards. For example, inone embodiment, the wireless communication network 102 comprises one ormore of a Long Term Evolution (LTE) network, LTE Advanced (LTE-A)network, an Evolution Data Only (EV-DO) network, a GPRS network, aUniversal Mobile Telecommunications System (UMTS) network, and the like.

FIG. 1 further shows that one or more user devices (also referred toherein as “user equipment (UE)”) 108, 110 are communicatively coupled tothe wireless communication network 102. The UE devices 108, 110, in thisembodiment, are wireless communication devices such as two-way radios,cellular telephones, mobile phones, smartphones, two-way pagers,wireless messaging devices, laptop computers, tablet computers, desktopcomputers, personal digital assistants, and other similar devices. UEdevices 108, 110 access the wireless communication network 102 throughone or more transceiver nodes 112, 114 using one or more air interfaces116 established between the UE devices 108, 110 and the transceiver node112, 114.

In another embodiment, one or more UE devices 108, 110 access thewireless communication network 102 via a wired network and/or anon-cellular wireless network such as, but not limited to, a WirelessFidelity (WiFi) network. For example, the UE devices 108, 110 can becommunicatively coupled to one or more gateway devices via wired and/orwireless mechanisms that communicatively couples the UE devices 108, 110to the wireless communication network 102. This gateway device(s), inthis embodiment, communicates with the wireless communication network102 via wired and/or wireless communication mechanisms.

The UE devices 108, 110 interact with the wireless communication network102 to send/receive voice and data communications to/from the wirelesscommunication network 104. For example, the UE devices 108, 110 are ableto wirelessly request and receive content (e.g., audio, video, text, webpages, etc.) from a provider, such as the server 106, through thewireless communication network 102. The requested content/service isdelivered to the wireless communication network 102 through the wireline network 104.

A transceiver node 112, 114 is known as a base transceiver station(BTS), a Node B, and/or an Evolved Node B (eNode B) depending on thetechnology being implemented within the wireless communication network104. Throughout this discussion a transceiver node 112, 114 is alsoreferred to as a “base station”. The base station 112, 114 iscommunicatively coupled to one or more antennas and a radio networkcontroller (RNC) 118 and/or base station controller (BSC) 119, whichmanages and controls one or more base station 112, 114. It should benoted that in a 4G LTE network, the eNodeB communicates directly withthe core of the cellular network.

The RNC 118 and/or BSC 119 can be included within or separate from abase station 112, 114. The base stations 112, 114 communicate with theRNC 118 over a backhaul link 120. In the current example, a base station112, 114 is communicatively coupled to a Serving GPRS (SGSN) 122, whichsupports several RNCs 118. The SGSN 122 is communicatively coupled toGateway GPRS Support Node (GGSN) 124, which communicates with theoperator's service network (not shown). The operator's service networkconnects to the Internet at a peering point. It should be noted thateven though UMTS components are illustrated in FIG. 1 embodiments of thepresent invention are applicable to other wireless communicationtechnologies as well.

In another example, the base stations 112, 114 communicate with the BSC119 over the backhaul link 120. In this example, a base station 112, 114is communicatively coupled to a mobile switching center (MSC) 121, whichsupports several BSCs 119. The MSC 121 performs the same functions asthe SGSN 122 for voice traffic, as compared to packet switched data. TheMSC 121 and SGSN 122 can be co-located. The MSC 121 is communicativelycoupled to a gateway mobile switching center (GMSC) 123, which routescalls outside the mobile network.

In one example, the communication protocols between the UE devices 108,110 and the GGSN 124 are various 3rd Generation Partnership Project(3GPP) protocols over which the internet protocol (IP) traffic from theUE devices 108, 110 is tunneled. For example, a GPRS tunneling protocol(GTP) is utilized between the RNC 118 and the GGSN 124. A standardInternet Protocol (IP) is utilized between the GGSN 124 and the wireline network 104. The server(s) 106 has a TCP (Transmission ControlProtocol) socket that communicates with a TCP socket at the UE devices108, 110 when a user wishes to access data from the server 106. An IPtunnel is created from the GGSN 124 to UE devices 108, 110 for usertraffic and passes through the interim components, such as the RNC 118and the SGSN 122.

As noted above, mobile networks require a high degree of reliability andavailability to provide a satisfactory user experience. Therefore, oneor more embodiments of the present invention implement a networkmanagement system (NMS) 126 within or communicatively coupled to thewireless communication network 102. The NMS 126, in one embodiment,comprises a network monitor 128 that collects network data 130associated with the wireless communication network 102. For example, thenetwork monitor 128 periodically collects network data 120 such as (butnot limited to) performance metrics associated with one or more networkelements (BTS, BSC, MSC, SGSN, NodeB, RNC, GGSN, etc.) using a set ofprotocols such as the simple network management protocol (SNMP) orequivalent protocols. Network data 130 can also include (but is notlimited to) network traffic information such as number/duration ofcalls, amount of data that has been transmitted/received on each networkinterface, interface/link failure information if any, etc. In oneembodiment, special purpose hardware network probes (not shown) arecommunicatively coupled to one or more of these network elements. Thenetwork probes collect information corresponding to their networkelements and communicate their collected data to the NMS 126. Thenetwork monitor 128 stores this received data as network data 130. Inone embodiment, the network probes utilize dedicated communicationchannels to report the metrics they collect to the NMS 126 via SNMP orequivalent protocols.

In some instances the volume of data collected by the NMS 126 can causea significant overload on the network. Therefore, one or moreembodiments implement an adaptive monitoring manager 132 within orcommunicatively coupled to the wireless communication network 102. Theadaptive monitoring manager 132, in one embodiment, comprises a dataanalyzer 202, a behavior/traffic predictor 204, and an anomaly detector206, as shown in FIG. 2. Each of these components of the adaptivemonitoring manager 132 is discussed in greater detail below.

The adaptive monitoring manager 132, in one embodiment, utilizes calldetail records (CDRs) 134, also referred to as “charging data records”or “call data records”, to determine the status of the network operationand subsequently perform an adaptive adjustment the network monitoringoperations performed by the NMS as needed. A CDR 134 is a formattedmeasure of a UE's service usage information (placing a phone call,accessing the Internet, etc.). For example, a CDR 134 includesinformation related to a telephone voice or data call such as (but notlimited to) the origination and destination addresses of the call; thetime the call started and ended; the duration of the call; the time ofday the call was made; call termination and error codes; and otherdetails of the call. A CDR 134 also comprises some (partial) informationabout which network elements handled the particular call. A CDR 134 istypically generated by one or more network functions that supervise,monitor, and/or control network access for the device such as the MSC121 for voice calls and the SGSN 122 for data calls. One non-limitingexample of a format for a CDR is provided by the 3GPP specification32.297 (see 3gpp.org/ftp/Specs/html-info/32297.htm), which is herebyincorporated by reference.

In one embodiment, the NMS 126 and the adaptive monitoring manager 132are co-located within one or more servers 136. However, the NMS 126 andthe adaptive monitoring manager 132 are not required to be co-located.In addition, the adaptive monitoring manager 132 can be part of the NMS126 as well. In other embodiments, the adaptive monitoring manager 132resides at the source of the CDRs 134 (e.g., the MSC 121 and/or the SGSN122) and/or the at the source of CDR aggregation (e.g., the server 136).The server 136, in one embodiment, is a datacenter that receives CDRs134 from a network element such as the MSC 121 and/or the SGSN 122 forbilling purposes. The server 136, in on embodiment, stores CDRs 134 fora given period of time. Stated differently, the server 136 stores andmaintains historical CDR data for a given amount of time. In addition toCDR data, the server 136 can also include other information such asrecords of user addresses, user billing plans, etc.

Adaptive Network Monitoring Using CDRs

As will be discussed in greater detail below, the adaptive monitoringmanager 132 analyzes and processes 134 CDRs to obtain proxy measures fortraffic volume on a network device and/or for failures that arehappening in a portion of the network 102. Once the adaptive monitoringmanager 132 detects an abnormality in the metrics provided by a CDR(s)134, the adaptive monitoring manager 132 communicates with the NMS 126to adjust the frequency at which network performance metrics arecollected from different network elements. For example, if a part of thenetwork 102 is experiencing high failure rates, network probes that cancollect more detailed information are turned on for devices in that partof the network 102. The frequency of monitoring for one or more networkdevices can also be increased so that more frequent detailed performancemetrics are collected from that device.

In one embodiment, the adaptive monitoring manager 132 receives as inputa historical set of CDRs 134 stored at the server 136 or anotherlocation and optional historical network data 130 collected by the NMS126. The data analyzer 202 of the adaptive monitoring manager 132utilizes this input as a training dataset for one or more machinelearning operations. Based on these learning operations the adaptivemonitoring manager 132 identifies normal operatingcharacteristics/attributes (e.g., behavior) for the network 102 as awhole and/or for one or more of its network elements. The learningoperations can be performed for a plurality of different operatingcharacteristics such as (but not limited to) traffic rates experiencedby the network/elements/users; congestion occurrences/rates experiencedby the network/elements/users; failure occurrences/rates experienced bythe network/elements/users; signal strength and other quality indicationobserved by the network/elements/users; and/or the like.

For each operating characteristic of interest the data analyzer 202identifies the corresponding data/information within the historical setof CDRs 134 and/or historical network data 130 and uses this data asinput for the machine learning operations. For example, if the adaptivemonitoring manager 132 wants to learn a normal rate of congestion for aspecific network element such as a transceiver node 112 the dataanalyzer 202 identifies number and duration of calls or number of bytestransmitted during a time duration from a plurality of the historicalset of CDRs 134 and/or historical network data 130 and uses this data asinput for the learning operations.

Based on the learning/prediction operations the adaptive monitoringmanager 132 learns a baseline/threshold for one or more operatingcharacteristics corresponding to the entire network 102 and/or one morespecific network elements. Stated differently, the adaptive monitoringmanager 132 learns the normal behavior of the network 102 and/or one ormore of its elements. It should be noted that normal operatingcharacteristics can be learned at different granularities such asspecific times of the day, week, year, etc. Also, it should be notedthat the normal operating characteristics may capture regular changes innetwork traffic and conditions that are found daily, weekly, monthly,etc. For example, these captured characteristics can indicate that thenumber of calls observed during normal business hours is greater thanthe number of calls observed during the late evening or early morninghours. The learned normal operating characteristics are then used as theexpected state of the network or its elements when analyzing new networkdata (such as per call measurement data, or PCMD) 130 and/or CDRs 134.

The following is one example of learning the normal operatingcharacteristics of the network 102. In this example, the normaloperating characteristic of interest is the normal traffic pattern ofvoice calls that are observed in a region (e.g., calls placed andreceived in the area code 914) that has been operated normally. Pastnetwork data and/or CDRs collected for that region are analyzed and thenumber/duration of calls and failure occurrences that have been observedduring a certain time period are counted, which yields the normaltraffic pattern for the region of interest. This analysis process can beperformed at various levels of granularity. For example, the operationcharacteristic for the past month can be analyzed in terms of number ofcalls and failures at a 15 minute granularity. This establishes thenormal operating characteristics of the network in terms ofnumber/duration of calls for that month.

As new network data 130 and/or CDRs 134 are generated they are sent tothe server 136 and processed by the adaptive monitoring manager 132. Theanomaly detector 206 of the adaptive monitoring manager 132 compares thenewly received data 130, 134 to the expected state/value(s) for one ormore operating characteristics of interest to determine if abnormalbehavior is occurring. For example, if the adaptive monitoring manager126 is interested in failure occurrences (e.g., dropped calls) withinthe network/elements the anomaly detector 206 analyzes the received datato determine a current state of the network/elements with respect tofailure occurrences. The failure occurrence, for example, can beidentified from the error code contained in the CDR or can be learnedfrom PCMD. The current state in this example can be a number of failureoccurrences that have occurred within the network/elements for a giveninterval of time.

The anomaly detector 206 then compares current state determined for theoperating characteristic of interest to the expected state/value(s) forthis operating characteristic. In particular, the expected state is usedas a threshold to determine if abnormal behavior is occurring in thenetwork/elements. In one embodiment, if the current state satisfies thisthreshold (i.e. corresponds to the expected state) the anomaly detector206 determines that the operating characteristic of interest is withinnormal limits. If the current state fails to satisfy the threshold (i.e.does not correspond to the expected state) the anomaly detector 206determines that abnormal behavior is occurring within thenetwork/elements. It should be noted that depending on the expectedstate, the current value(s) can satisfy or fail to satisfy thestate/threshold by either being one of equal to or less than thethreshold, or by being one of equal to or greater than the threshold. Itshould also be noted that anomaly detection (abnormal behaviordetection) can be performed for a plurality of different operatingcharacteristics of interest either simultaneously or in a pipelinedmanner.

In one embodiment, if the network/elements are determined to beoperating within normal conditions with respect to the operatingcharacteristic(s) of interest the anomaly detector 206 adds the datafrom the CDR 134 and/or network data 130 corresponding to the operatingcharacteristic(s) of interest to the historical set of CDRs 134 andnetwork data 130, respectively. The data analyzer 202 can then performone or more machine learning operations on this updated set ofhistorical data to update the expected state of the operatingcharacteristic(s) of interest. It should be noted that data from CDRs134 indicating abnormal behavior in the network 102 and/or its elementscan also be added to the historical set of CDRs 134 as well.

If the network 102 and/or given network elements are determined to beoperating abnormally, the anomaly detector 206 communicates with the NMS126 to initiate and/or modify its monitoring processes. Stateddifferently, the monitoring operations of the NMS 126 areadapted/adjusted based on the detected abnormal (or normal) behaviors ofthe network 102 and/or one or more of its elements. This adaptationprocess can include starting/stopping the monitoring of the network 102as a whole or one or more of its elements. As discussed above, theamount of data collected by the NMS 126 and the number of resourcesrequired by the NMS 126 can be very large. The NMS 126 can be configuredto start or stop all monitoring operations or monitoring operations forone or more network elements. For example, if a given set of networkelements is exhibiting abnormal behavior the network probes only forthis set of network elements can be started. Once the adaptivemonitoring manager 132 determines that the given set of network elementsis exhibiting normal behavior the monitoring of these elements can bestopped or the frequency of monitoring can be reduced.

The adaptation process can further include increasing/decreasing thefrequency of monitoring by the NMS 126. For example, to save resourcesthe NMS 126 can be initially configured to perform monitoring of thenetwork 102 as a whole or one or more of its elements at a lowfrequency. When the network 102 or a set of its elements is exhibitingabnormal behavior the frequency of monitoring (e.g., frequency of datacollection) for these elements can be increased. Once the adaptivemonitoring manager 132 determines that the given set of network elementsis exhibiting normal behavior the monitoring of these elements can bedecreased.

In other embodiments, the adaptation process can also includecategorizing information collected by the NMS 126 into different levelsof detail on the network side. Adaptation can then be enabled throughincremental drill down to first provide a coarse level information andthen finer-level information if a current coarse-level information isnot sufficient. For example, coarse level information can be theoriginating and terminating base station for a session, whereasfiner-level information can be the CDRs per handoff to capture all thebase station associations along a user's trajectory. This adaptationprocess can be performed manually or automatically (e.g., based onconfiguration, script, policy rules).

In another embodiment, the adaptation process includes classifyinginformation logged on the network side into different classes based ondifferent failure codes. Then a code-specific class can be enabled formonitoring dynamically. That is, only certain information may berelevant to certain kinds of cause codes. The classification can beautomatically learned over a period of time, by examining the “utility”(or importance) of different data items received for each failure type.The NMS 126 can then be configured to only collect the information thatis relevant to a class of cause codes.

In some situations, there can be a time lag between generation of logs(e.g., CDRs 134) at the source network element (MSC/SGSN/GGSN) and itsavailability at the point of storage and analysis (e.g., server 136). Insuch a case, the prediction module 204 of the adaptive monitoringmanager 126 performs one or more prediction algorithms for estimatingthe current state and adapting the NMS monitoring operations basedthereon. These prediction operations keep the monitoring adaptation inreal-time when a time lag occurs. Any prediction algorithm can be usedto predict the current state of the network and/or one or more of itselements. For example, forecasting algorithms that are based onregression such as linear regression, auto regression, or exponentialsmoothing such as Holt-Winters can be used to predict what is the normalbehavior of the network/elements in the near future.

It should also be noted that the adaptive monitoring manager 132 is notlimited to residing within the server 136 and/or the NMS 126. Forexample, the adaptive monitoring manager 132 can reside at the source ofthe CDRs 134, which are network elements such as the MSCs 119, the SGSNs122, GGSN, etc. The network elements can analyze the cause codes offailure and increase the reporting frequency of the NMS network data 130if the failure rate increases above a certain threshold. In anotherembodiment, the adaptive monitoring manager 132 can also reside at apoint of aggregation of the CDRs 134 such as a telephone exchange. Inthis embodiment, logs from multiple network elements are analyzed toidentify an area that is experiencing issues such as all the NodeBsattached to a specific RNC. The adaptive monitoring manager 132 can thenincrease the monitoring performed by the NSM 126 at each of thecorresponding elements.

It should also be noted that the adaptive monitoring manager 132 is notlimited to analyzing network data 130 and CDRs 134. For example, theadaptive monitoring manager 132 can be integrated with other sources ofinformation such as (but not limited to) a customer care system to adaptits operation based on external information. In another embodiment, theadaptive monitoring manager 132 is integrated with side-channelinformation. A side-channel can be, but is not limited to, a news sourceabout events that result in major changes in network used. For example,if it is known that a certain event such as a holiday, festival,concert, severe weather occurrence, etc. is occurring within a specificregion the network monitoring operations of the NMS 126 for that regioncan be augmented appropriately.

Operational Flow Diagrams

FIG. 3 is an operational flow diagram illustrating one example ofadaptive monitoring for a wireless communications network. Theoperational flow diagram of FIG. 3 begins at step 302 and flows directlyto step 304. The adaptive monitor 132, at step 304, determines operatingcharacteristic thresholds for one or more operating characteristics ofthe network 102 and/or any of its elements. As discussed above, thesethresholds or expected states are based on a set of network data 130and/or a set of historical CDR data 134. In one embodiment, the set ofnetwork data 130 comprises the CDR data 134. The adaptive monitor 132,at step 306, receives a set of CDRs and/or network data.

The adaptive monitor 132 compares the information within the receivedset of CDRs and/or network data to one or more of the operatingcharacteristic thresholds. For example, the adaptive monitor 132, atstep 308, determines if a current traffic rate/pattern indicated by thereceived set of CDRs and/or network data exceeds a traffic threshold. Ifthe result of this determination is positive, the adaptive monitor 132,at step 310, increases the rate and type of metrics logged by the NMS126. If the result of this determination is negative, the adaptivemonitor 132, at step 312, determines if a current rate of failuresindicated by the received set of CDRs and/or network data exceeds afailure threshold. If the result of this determination is positive, theadaptive monitor 132, at step 314, increases the rate and type ofmetrics logged by the NMS 126. If the result of this determination isnegative, the adaptive monitor 132, at step 316, determines if anyanomalous behavior has been detected based on a comparison of theinformation within the received set of CDRs and/or network data and thehistorical set of CDRs 134 and/or historical set of network data 130. Ifthe result of this determination is positive, the adaptive monitor 132,at step 318, increases the rate and type of metrics logged by the NMS126. If the result of this determination is negative, the control flowreturns to step 304 where the thresholds are updated based on thereceived set of CDRs and/or network data. It should be noted that if agiven threshold is not exceeded or anomalous behavior is not detectedthe adaptive monitor 132 can also decrease the rate and type of metricslogged by the NMS 126 if logging is currently being performed. It shouldbe noted that the normal operation range may be represented as a rangeor a set of values, not just as a threshold. In this embodiment, thesame process applies with the change of testing if a new value is withinthe range or not, or if a new value is in the set or not.

FIG. 4 is an operational flow diagram illustrating another example ofadaptive monitoring for a wireless communications network. Theoperational flow diagram of FIG. 4 begins at step 402 and flows directlyto step 404. The adaptive monitor 132, at step 404, analyzes a first setnetwork data such as (but not limited to) call detail records 134generated for a wireless communication network 102. In this embodiment,the first set of network data is a set of historical network data (e.g.,historical call detail records) for the wireless communication network102. The adaptive monitor 132, at step 406, determines, based on theanalyzing, a baseline for at least one operating characteristicassociated with the wireless communication network 102.

The adaptive monitor 132, at step 408, receives a second set of networkdata such as (but not limited to) call detail records generated for thewireless communication network 102. The adaptive monitor 132, at step410, determines, from the second set of network data that has beenreceived, if the at least one operating characteristic corresponds tothe baseline. The adaptive monitor 132, at step 412, dynamicallyadjusts, based on the at least one operating characteristic failing tocorrespond to the baseline, a set of monitoring operations performed bya network management system 126 with respect to the wirelesscommunication network 102. The control flow exits at step 414.

Information Processing System

Referring now to FIG. 5, this figure is a block diagram illustrating aninformation processing system that can be utilized in variousembodiments of the present invention. The information processing system502 is based upon a suitably configured processing system configured toimplement one or more embodiments of the present invention. Any suitablyconfigured processing system can be used as the information processingsystem 502 in embodiments of the present invention. The components ofthe information processing system 502 can include, but are not limitedto, one or more processors or processing units 504, a system memory 506,and a bus 508 that couples various system components including thesystem memory 506 to the processor 504.

The bus 508 represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA)bus, Video Electronics Standards Association (VESA) local bus, andPeripheral Component Interconnects (PCI) bus.

Although not shown in FIG. 5, the main memory 506 includes at least theadaptive monitor 132 and its components shown in FIG. 1. Each of thesecomponents can reside within the processor 504, or be a separatehardware component. The system memory 506 can also include computersystem readable media in the form of volatile memory, such as randomaccess memory (RAM) 510 and/or cache memory 512. The informationprocessing system 502 can further include other removable/non-removable,volatile/non-volatile computer system storage media. By way of exampleonly, a storage system 514 can be provided for reading from and writingto a non-removable or removable, non-volatile media such as one or moresolid state disks and/or magnetic media (typically called a “harddrive”). A magnetic disk drive for reading from and writing to aremovable, non-volatile magnetic disk (e.g., a “floppy disk”), and anoptical disk drive for reading from or writing to a removable,non-volatile optical disk such as a CD-ROM, DVD-ROM or other opticalmedia can be provided. In such instances, each can be connected to thebus 508 by one or more data media interfaces. The memory 506 can includeat least one program product having a set of program modules that areconfigured to carry out the functions of an embodiment of the presentinvention.

Program/utility 516, having a set of program modules 518, may be storedin memory 506 by way of example, and not limitation, as well as anoperating system, one or more application programs, other programmodules, and program data. Each of the operating system, one or moreapplication programs, other program modules, and program data or somecombination thereof, may include an implementation of a networkingenvironment. Program modules 518 generally carry out the functionsand/or methodologies of embodiments of the present invention.

The information processing system 502 can also communicate with one ormore external devices 520 such as a keyboard, a pointing device, adisplay 522, etc.; one or more devices that enable a user to interactwith the information processing system 502; and/or any devices (e.g.,network card, modem, etc.) that enable computer system/server 502 tocommunicate with one or more other computing devices. Such communicationcan occur via I/O interfaces 524. Still yet, the information processingsystem 502 can communicate with one or more networks such as a localarea network (LAN), a general wide area network (WAN), and/or a publicnetwork (e.g., the Internet) via network adapter 526. As depicted, thenetwork adapter 526 communicates with the other components ofinformation processing system 502 via the bus 508. Other hardware and/orsoftware components can also be used in conjunction with the informationprocessing system 502. Examples include, but are not limited to:microcode, device drivers, redundant processing units, external diskdrive arrays, RAID systems, tape drives, and data archival storagesystems.

Non-Limiting Examples

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method, or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention have been discussed above withreference to flowchart illustrations and/or block diagrams of methods,apparatus (systems) and computer program products according to variousembodiments of the invention. It will be understood that each block ofthe flowchart illustrations and/or block diagrams, and combinations ofblocks in the flowchart illustrations and/or block diagrams, can beimplemented by computer program instructions. These computer programinstructions may be provided to a processor of a general purposecomputer, special purpose computer, or other programmable dataprocessing apparatus to produce a machine, such that the instructions,which execute via the processor of the computer or other programmabledata processing apparatus, create means for implementing thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

The description of the present invention has been presented for purposesof illustration and description, but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Theembodiment was chosen and described in order to best explain theprinciples of the invention and the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

What is claimed is:
 1. A method for adaptive monitoring of a wirelesscommunication network, the method comprising: analyzing a firstplurality of call detail records, wherein each call detail record in thefirst plurality of call detail records is generated for a user equipmentdevice in a wireless communication network and comprises recorded dataassociated with at least one of a given voice session and a given datasession participated in by the user equipment, and wherein the firstplurality of call detail records is a historical plurality of calldetail records; determining, based on the analyzing, a baseline for atleast one operating characteristic associated with the wirelesscommunication network; receiving a second plurality of call detailrecords, wherein each call detail record in the second plurality of calldetail records is generated for a user equipment device in the wirelesscommunication network and comprises recorded data associated with atleast one of a given voice session and a given data session participatedin by the user equipment, the second plurality of call detail recordshaving been generated subsequent to the first plurality of call detailrecords; determining, from the second plurality of call detail records,if the at least one operating characteristic corresponds to thebaseline; and based on the at least one operating characteristic failingto correspond to the baseline, identifying a class of cause codesassociated with the operating characteristic failing to correspond tothe base line, identifying one or more types of information associatedwith the class of cause codes, and dynamically adjusting one or morenetwork probes communicatively coupled to a set of network elements inthe wireless communication network to only collect information from thewireless communication network corresponding to the one or more types ofinformation that have been identified.
 2. The method of claim 1, whereinthe baseline is further determined based on a set of metrics measuredfor the wireless communication network.
 3. The method of claim 1,wherein the at least one operating characteristic comprises at least oneof: a traffic rate associated with the wireless communication network; acongestion rate associated with the wireless communication network; anda failure rate associated with the wireless communication network. 4.The method of claim 1, wherein determining if the at least one operatingcharacteristic corresponds to the baseline comprises: analyzing thesecond plurality of call detail records; identifying, based on theanalyzing, the at least one operating characteristic from the secondplurality of call detail records.
 5. The method of claim 1, whereindynamically adjusting the set of monitoring operations comprises:increasing at least one of a number and a frequency of a set ofmonitoring operations performed by the one or more network probes,wherein the set of monitoring operations collect data associated withthe at least one operating characteristic.
 6. The method of claim 1,wherein the method further comprises: based on the at least oneoperating characteristic corresponding to the baseline, updating thebaseline based on information from the second plurality of call detailrecords.
 7. The method of claim 1, wherein the method further comprises:based on the at least one operating characteristic corresponding to thebaseline, dynamically adjusting a set of monitoring operations performedby the one or more network probes with respect to the wirelesscommunication network, wherein the dynamically adjusting comprisesdecreasing at least one of a number and a frequency of a set ofmonitoring operations performed by the one or more network probes,wherein the set of monitoring operations collect data associated withthe at least one operating characteristic.
 8. A computer program productfor adaptive monitoring of a wireless communication network, thecomputer program product comprising: a Non-transitory storage mediumreadable by a processing circuit and storing instructions for executionby the processing circuit for performing a method comprising: analyzinga first plurality of call detail records, wherein each call detailrecord in the first plurality of call detail records is generated for auser equipment device in a wireless communication network and comprisesrecorded data associated with at least one of a given voice session anda given data session participated in by the user equipment, and whereinthe first plurality of call detail records is a historical plurality ofcall detail records; determining, based on the analyzing, a baseline forat least one operating characteristic associated with the wirelesscommunication network; receiving a second plurality of call detailrecords, wherein each call detail record in the second plurality of calldetail records is generated for a user equipment device in the wirelesscommunication network and comprises recorded data associated with atleast one of a given voice session and a given data session participatedin by the user equipment, the second plurality of call detail recordshaving been generated subsequent to the first plurality of call detailrecords; determining, from the second plurality of call detail records,if the at least one operating characteristic corresponds to thebaseline; and based on the at least one operating characteristic failingto correspond to the baseline, identifying a class of cause codesassociated with the operating characteristic failing to correspond tothe base line, identifying one or more types of information associatedwith the class of cause codes, and dynamically adjusting one or morenetwork probes communicatively coupled to a set of network elements inthe wireless communication network to only collect information from thewireless communication network corresponding to the one or more types ofinformation that have been identified.
 9. The computer program productof claim 8, wherein the baseline is further determined based on a set ofmetrics measured for the wireless communication network.
 10. Thecomputer program product of claim 8, wherein the at least one operatingcharacteristic comprises at least one of: a traffic rate associated withthe wireless communication network; a congestion rate associated withthe wireless communication network; and a failure rate associated withthe wireless communication network.
 11. The computer program product ofclaim 8, wherein determining if the at least one operatingcharacteristic corresponds to the baseline comprises: analyzing thesecond plurality of call detail records; identifying, based on theanalyzing, the at least one operating characteristic from the secondplurality of call detail records.
 12. The computer program product ofclaim 8, wherein dynamically adjusting the set of monitoring operationscomprises: increasing at least one of a number and a frequency of a setof monitoring operations performed by the one or more network probes,wherein the set of monitoring operations collect data associated withthe at least one operating characteristic.
 13. The computer programproduct of claim 8, wherein the method further comprises: based on theat least one operating characteristic corresponding to the baseline,updating the baseline based on information from the second plurality ofcall detail records.
 14. The computer program product of claim 8,wherein the method further comprises: based on the at least oneoperating characteristic corresponding to the baseline, dynamicallyadjusting a set of monitoring operations performed by the one or morenetwork probes with respect to the wireless communication network,wherein the dynamically adjusting comprises decreasing at least one of anumber and a frequency of a set of monitoring operations performed bythe one or more network probes, wherein the set of monitoring operationscollect data associated with the at least one operating characteristic.